EUVD-2026-44208
GHSA-vpwg-hj8f-g57p
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
SSRF inherently pivots the server to reach internal services outside SharePoint's security scope (S:C); C:L reflects partial disclosure from reachable internal targets; PR:L confirms mandatory authentication.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
AnalysisAI
Server-side request forgery in Microsoft SharePoint Server enables authenticated, low-privileged users to force the server to issue outbound network requests, exposing internal resources and sensitive data not directly accessible to the attacker. All three actively supported SharePoint server editions are affected: Enterprise Server 2016, Server 2019, and Subscription Edition. No public exploit code or CISA KEV listing exists at time of analysis; EPSS sits at 0.59% (44th percentile) and SSVC rates exploitation as none, indicating limited real-world exploitation activity despite the medium-high CVSS score.
Technical ContextAI
Microsoft SharePoint Server is an enterprise collaboration and document management platform built on ASP.NET and IIS. CWE-918 (Server-Side Request Forgery) arises when the server fetches or interacts with a remote resource based on attacker-supplied input without adequate validation or allowlisting of the target URL. In SharePoint's architecture, certain endpoints or features process URLs or URIs provided by users and can be abused to route requests through the SharePoint server to internal infrastructure - intranet hosts, cloud metadata endpoints, internal APIs - that would otherwise be network-unreachable from the attacker's position. Confirmed affected CPEs are cpe:2.3:a:microsoft:microsoft_sharepoint_enterprise_server_2016, cpe:2.3:a:microsoft:microsoft_sharepoint_server_2019, and cpe:2.3:a:microsoft:microsoft_sharepoint_server_subscription_edition, spanning all current on-premises SharePoint deployment tracks.
RemediationAI
Apply Microsoft's released cumulative updates to reach the following minimum fixed builds: SharePoint Enterprise Server 2016 to 16.0.5561.1001 or later, SharePoint Server 2019 to 16.0.10417.20175 or later, and SharePoint Server Subscription Edition to 16.0.19725.20434 or later. Patch details and download links are available via the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55051. As a compensating control pending patching, implement strict egress filtering on the SharePoint server's outbound HTTP/HTTPS traffic, restricting connections only to explicitly approved external endpoints; this limits SSRF pivot reach to internal services but does not eliminate the vulnerability and may disrupt SharePoint features relying on outbound connectivity such as link validation or external content syndication - assess operational impact before deploying. Additionally, enforce the principle of least privilege on SharePoint account provisioning to reduce the population of users who can trigger the flaw.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated atta
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) all
Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) l
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Authenticated remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Editi
Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016 and Server 2019) allows an authenticated netw
Privilege escalation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets
Cross-site scripting (CWE-79) in on-premises Microsoft SharePoint Server allows an authenticated, low-privileged attacke
Spoofing via stored cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription
Local code execution in Microsoft Word (and Office/SharePoint components that render Word content) stems from an integer
Arbitrary code execution in Microsoft Office Word (and the broader Office/365/SharePoint family) arises from a stack-bas
Local code execution in Microsoft Word (part of Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024, and Office for M
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today